Extracted

• • Target
    PEDIDO DE COMPRA I122825.exe
  • Size 671KB
  • SHA256 d1eb3ca7fba3768f873fc91d8f07274c89de6e32fe3ba4db03ecf0bfb9902e00
  • MD5 1f021d4ca98819877db4f77fdeb4d05b
  • SHA1 c9926be218481a8339e99fd6ce71124d7e375d38
  • SHA512 2c266642b34f1f16d80241583b4e50b2c4c2215368fce4de9ac7396647fa98f940f54ba2949a2a4d85287b909dca105045a37e4297d015cd16ee6e0a10c0c2bb
  • SSDEEP 12288:0oKoh70D0pj2rm/3SeMa58EkI+iFZXsEhNt4izddeqRvdHJY2MorAMuMyE:vh7GyD8EPfFZNnddeUJY2Xug
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2